Filipinos’ data at risk as gov’t grapples with data breaches

by Lian Gabrielle Inlong

Data breaches in different government agencies sound an alarm on millions of Filipinos after reports of their personal and sensitive information being compromised, making the latter vulnerable to identity theft, phishing attacks, and other privacy-related violations.

In 2023 alone, several institutions, including primary government agencies, suffered data breaches due to cyberattacks that allowed access to sensitive data in these institutions’ registries.

Last Aug. 31, data on names and email addresses of technical experts and users were leaked from the OneExport Portal of the Department of Science and Technology (DOST) through a compromised account as reported by the Philippine National Computer Emergency Response Team (CERT-PH).

Who bears the brunt?

DOST assured the public that no sensitive information was compromised and that additional security measures were put up to address the attack and to restore operations immediately.

On Sept. 22, the Philippine Health Insurance Corporation (PhilHealth) was hit by the Medusa Ransomware Attack caused by a file-encrypting malware that demands a ransom payment to be decrypted.

According to the Department of Information and Communications Technology (DICT) undersecretary Jeffery Dy, stolen PhilHealth data containing personal information was leaked on the dark web, regular web, and on Telegram, including PhilHealth ID Numbers (PINs).

Although PhilHealth has assured its members that information on their contributions and accreditations remains intact, employee payrolls, identification cards of members, and hospital bills have already become publicly available on various internet sites.

Following the PhilHealth breach, the Philippine Statistics Authority (PSA) was the next government agency to suffer attacks by cyberhackers. The attacks affected its Community-Based Monitoring System responsible for Local Government Units (LGUs) planning, implementation, assessment, and intervention activities, and the Department of Social Welfare and Development’s (DSWD) social protection programs. PSA assured the public that the Philippine Identification System and the Civil Registration System were not compromised.

House of Representatives was the most recent victim of cyberattacks as their website was defaced last Oct. 17 by a hacker named 3MUSKETEERZ, which prompted the DICT and other law enforcement agencies to investigate the incident.

DICT secretary Ivan Uy pointed out that while cybercrime threats soar, the funds for cybersecurity remain dwindling.

Web of woes

As these data breaches continue to pose a threat to Filipinos’ sensitive data, Kabataan Partylist representative Raoul Manuel warned that the continuous implementation of the SIM card registration law might as well result in subsequent cases of data breaches in the country.

Rep. Manuel stated that unless the government can ensure the safety of the country’s cybersecurity, the public’s information cannot be trusted with them.

These data breaches call for the strengthening of cybersecurity in the country, especially within government agencies that handle, collect, and store information that millions of Filipinos have entrusted them.

Agham Youth (AY) National, together with other privacy advocates, called for justice and accountability for the violations against data privacy and data security of Filipinos committed under the Marcos-Duterte administration.

“These are direct manifestations that the data of Filipino people are at risk in the hands of the Marcos-Duterte [g]overnment. Agham Youth stands with other privacy advocates, concerned citizens, and vulnerable sectors in demanding for justice and accountability on the violations of data privacy and data security of the Filipino committed by the Marcos-Duterte government,” said AY-National.